C# PEToolkit || Module Dumper || PE Viewer || RunPE Check

[C#] PEToolkit || Module Dumper || PE Viewer || RunPE Check - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] PEToolkit || Module Dumper || PE Viewer || RunPE Check (/showthread.php?tid=5023782)

PEToolkit || Module Dumper || PE Viewer || RunPE Check - BahNahNah - Oct 16, 2015

I needed a PE viewer because the one i was using told me i had to pay for it >.<

Download: Github

Gif:
Spoiler (Click to View)

Screenshots:
[Image: GNEIW7a.png]

* - ProtectNull™ - Oct 16, 2015

Nice program BahNahNah :)

* - Multibyte - Oct 16, 2015

I'm gonna check it out, thanks for the release Sir 🙂.

* - DisguiserNET - Oct 16, 2015

cff explorer or dnspy would have already offered all this, but well done anyway!

* - Barthezz - Oct 16, 2015

Thanks for this, and vouch for BahNahNah

* - BahNahNah - Dec 2, 2015

1.0.0.2

Added extra PE structures for .net folds and processes. (COR20, MetaData, Table Stream Headers, Data Streams)

[Image: Yx75V4H.png]

Storage Streams:
Spoiler (Click to View)

To do
-Add hex viewer for storage streams
-Parse text from "US" storage stream (mabe)
-Add support for table stream rows

* - Only3 - Dec 3, 2015

To Do : Import Export Resource Diretorys
at the end u understand him 😁

* - Hoody - Dec 7, 2015

Hey BahNahNah, whats up bro?

Just thought I'd bug you, technically the 'MZ' signature at the beginning of a DOS header is not a "String" as you say in your program. It is a WORD orrr uint16. A string needs to be null terminated...

EDIT: annndddd for the RunPE check, you should exclude the ImageBase value. Because in the file, it points to the base in the file. And in memory (the process) it points to where the Image was mapped in memory, which is not the same offset from the pointer as in the executable file.

* - BahNahNah - Dec 7, 2015

(Dec 7, 2015 05:54 PM)Hoody Wrote: Hey BahNahNah, whats up bro?

Just thought I'd bug you, technically the 'MZ' signature at the beginning of a DOS header is not a "String" as you say in your program. It is a WORD orrr uint16. A string needs to be null terminated...

EDIT: annndddd for the RunPE check, you should exclude the ImageBase value. Because in the file, it points to the base in the file. And in memory (the process) it points to where the Image was mapped in memory, which is not the same offset from the pointer as in the executable file.

Thanks for the heads up on the RunPE checker, fixed.
I know that the magic numbers are 2 byte unassigned numbers, but i prefer to display the DOS one as a string. I have changed the type display from "String" to "char[]" though.

* - Hoody - Jan 7, 2016

For how much work you put into this you received so little credit :/

* - Lijpee - Feb 3, 2016

Beautiful BahNahNah, as always. Keep up the good work! Beudiful.

* - KillaMuvz_temp - Feb 22, 2016

I saw this a while ago, but didn't expect it to only have 2 pages of replies. Excellent job.